ChainVeil and ViteVenom are DPRK’s PolinRider Campaign

What it is

OpenSourceMalware's attribution analysis arguing that Checkmarx Zero's ChainVeil (nine malicious npm packages, published under maintainer successkeyteck; Checkmarx named the operator "SuccessKey") and its sequel ViteVenom (seven Vite-ecosystem typosquats) are not a new actor but the DPRK/Lazarus PolinRider campaign running against npm and Vite. The practical payload of the page is a concrete IOC set and package list you can feed into detection.

How it works

The malicious packages use a four-tier blockchain C2 spanning TRON, Aptos, and Binance Smart Chain, delivering a 77KB RAT. Attribution rests on five values that OpenSourceMalware published in its March 8, 2026 PolinRider dossier — 100 days before Checkmarx's report and 71 days before ChainVeil's first npm package — and which reappear byte-for-byte in ChainVeil:

• XOR key 2[gWfGj;<:-93Z^C
• XOR key m6:tTh^D)cBz?NM]
• TRON wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP
• TRON wallet TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG
• Aptos address 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e

The primary TRON wallet had been rotated 17 times (17 payload updates traced to June 2025); the same wallets/keys also anchor the author's March 31 TasksJacker report. A persistent A6- marker convention is treated as an operator signature: ChainVeil markers A6-519-81, A6-420, A6-317, A6-318, plus a6-shadow-15 (tailwind-color-shades) and a6-orion-271 (secure-box).

What to do

• Merge any separate ChainVeil / ViteVenom / PolinRider tracking entries into one.
• Treat all versions of the listed packages as malicious — the author states these are DPRK-owned and some remain live on npm, some pulled or replaced with 0.0.1-security placeholders.

Named packages (maintainer successkeyteck unless noted):

The fetched text is truncated mid-table (@vitets/vi), so the ViteVenom list is incomplete — consult the source for the remaining entries. Also flagged as PolinRider: tailwind-mainanimation (npm user allavin).

Caveats

Attribution is blockchain-infrastructure-based. Checkmarx itself rated shared-operator only "high confidence" and explicitly noted "blockchain attribution carries inherent limitations" and that a "shared-infrastructure-as-a-service model cannot be ruled out" — i.e. shared wallets/keys don't strictly prove a single operator. The typosquat-namespace overlap is described as a pattern, not a shared IOC.